Hacker News Reader

Comment by 101008 | Hacker News Reader

A colleague lost their phone and send an email to GitHub asking for a password and 2FA reset. It was sent from his account email and it was succesful. I found it weird because it means someone got access to his email Github would provide access to their account.

View on HN

2Fa is an excuse for we want more sales channels.

You can put an auth cookie in a browser and achieve 2FA for 99% of use cases without bothering anyone.

But nobody does that when they can use 2FA as an excuse to force people to install their app or hand over more personal information.

No reason 2FA can't be just two passwords.

> You can put an auth cookie in a browser and achieve 2FA for 99% of use cases without bothering anyone.

Confusing, obviously incorrect.

> No reason 2FA can't be just two passwords.

Maybe somewhat less obviously incorrect, but still incorrect. Passwords can be phished easily, are managed by users, etc.

If you can phish the pw you can phish the totp. People type it in right after they type in the pw.

Yes, but the TOTP is only usable once and cannot be reused across unrelated sites ("password stuffing"). And with WebAuthn / U2F the second factor is completely unphishable.

You cannot guarantee "completely unphishable", only that you cannot yet conceive of a way to do it. It's very dangerous to assume that something is completely secure.

WebAuthn binds the credential to the domain. Under the assumption that your web browser and security key is operating according to spec this is unphishable. If your web browser or key contains a bug, or the domain is breached then all bets are off anyway.

Yes, but you can't guess a TOTP. You can guess a password. But I hope that Github will make their FIDO2 support better.

Only if the user chooses a guessable password.

If you really must protect the user from themself (which I don't think you should, except in much more extreme circumstances), you can generate the password for them.

That doesn't make his point invalid. All this does is share your personal belief that passwords can be phished easily.

You know what is less secure than a password? A phone. A phone is a sim swap away from being hacked at anytime.

Yeah, a phone is an endless source of possibilities: every auth SMS is (not "can be", not "may be", but "by design") intercepted and logged. Every app can be breached remotely. Every interface, especially wireless, is a potential point of entry. Abundance of non-user-trusted components (like most processors, controllers and SIM). Possibilities of covert data exfiltration. Lots of sensors and ways of real human identification. Proprietary platforms and OSes that don't receive patches. A phone is the WORST thing to entrust your auth keys to.

I am against SMS 2FA.

> No reason 2FA can't be just two passwords

That's not two factors, that's one factor (something you know) twice, even if it is different passwords.

2FA satisfies the "something you have" authentication type. Passwords satisfy the "something you know" type.

>2FA satisfies the "something you have" authentication type.

In the general sense perhaps. As it's commonly implemented, no not really.

Reply on news.ycombinator.com